Clarion Street

The Agent Control Plane Goes Open Source: OpenClaw Enterprise and the Third Layer of the Stack

·7 min read

I have spent September watching the agent stack assemble itself in public, one layer at a time. First the harness, the thing that decides what a model can see and which tools it can reach. Then the runtime, the sandbox that makes a forbidden action impossible rather than merely unrequested. I wrote the runtime piece, The Secure Agent Runtime Arrives, when NVIDIA and Red Hat shipped that layer on September 28. On September 29 the third layer arrived, and it is the one I least expected to go open source. OpenClaw Enterprise, a control plane for managing fleets of persistent agents, launched as MIT-licensed, self-hostable software that describes itself as vendor-neutral. It was built inside OpenAI, donated to a foundation, and is now developed with Red Hat and NVIDIA contributing. OpenAI is piloting it internally [1][4].

The control plane is not new to this site. I made the “Kubernetes moment for agents” argument in The Rise of the Agent Control Plane on September 21, using WSO2 Agent Manager and Google’s AX Open Runtime as the evidence. Those were a single vendor’s open source project and a hyperscaler’s platform. This week it landed as MIT-licensed software donated to a foundation, originated at OpenAI and developed in the open with contributions from Red Hat and NVIDIA. That is the difference, and it is why I am writing about it again rather than linking and moving on.

What OCE is

OpenClaw Enterprise, or OCE, is not a model and not a runtime. It is a control plane: infrastructure for deploying and governing a fleet of agents across an organization, rather than defining how any one agent thinks. The project’s own shorthand is “Kubernetes for agents” [2][4]. It adds the things Kubernetes added to containers: multi-tenancy, hard security boundaries, fine-grained permissions, workload isolation, sandboxing, and auditing. It also adds LLM-based review of agent actions, which has no container-era equivalent. The harness, the model, and the sandbox underneath it all stay swappable [1][4].

The stated motivation is worth pausing on, because it is not “agents are too capable.” It is that most IT organizations today respond to agent platforms by banning them. Common security, safety, and governance standards do not exist yet, so the default posture is to say no. OCE is pitched as the layer between “ban it” and “deploy it unsupervised” [1].

It is self-hostable now, Docker Compose for local development and Kubernetes for internal deployments, and the announcement says it will “always be free for any organization to use” [1][4]. Free here means the MIT license. Compute, models, storage, and the operations staff are still your bill. The repository includes a dedicated OpenClaw Control Plane, or OCC, for agent deployment and lifecycle management [2][4]. The repo’s own structure encodes the governance model: a packages/iam layer for identities, roles, and resource authorization, and a packages/audit layer for audit events and sanitizing sensitive values out of them [2].

Who built it, and who is using it

The provenance is the part I keep coming back to. OCE originated inside OpenAI and was then donated to the OpenClaw Foundation, where it now runs as an independent open source project with contributions from Red Hat and NVIDIA. OpenAI and Red Hat are both piloting it internally [1][4].

OpenAI is a backer and a pilot user of OCE [1][4]. It also runs persistent OpenClaw agents with access to its own codebases and plugins. One of them, Androidclaw, is described by RJ Marsan, a member of OpenAI’s technical staff, as an internal enterprise agent that works across company context, Git, GitHub, and logging. It can trace a broken build back to the offending pull request and “in some cases prepare and merge fixes” [1][4]. Androidclaw is the most concrete thing in the announcement: an agent doing real internal work against a vendor’s own code. The sources tie it to OpenClaw, not to OCE specifically, so I will not claim the tighter connection.

Red Hat’s framing is the clearest statement of what the category thinks it is. Joe Fernandes, VP and GM of Red Hat’s AI business unit, writes that “another important layer of the enterprise AI stack is emerging: an open control plane for agents,” and positions OCE as the next step in the Linux-then-Kubernetes playbook [3]. Red Hat sponsors the OpenClaw Foundation, is putting engineers behind it, and says it will deploy OCE to orchestrate its own internal agent deployments [3]. Kevin Lin, who leads OCE at OpenAI, describes the goal as “a trusted, open foundation for how agents are managed and deployed in the enterprise” [3].

Where it sits in the stack matters. NVIDIA’s OpenShell, the runtime from the day before, enforces what an agent may do inside an isolated environment. OCE sits above that. It governs the fleet while the runtime sandboxes each agent [4][5].

Product or protocol

The battle line is open versus commercial, and it has a name on the other side. Runlayer is a venture-backed enterprise AI control plane that raised a $30 million Series A in June 2026 and has $42 million total, with Instacart, Gusto, Opendoor, and dbt Labs as customers [4]. It sells the same category OCE gives away as MIT. A lightweight personal-agent runtime called NanoClaw sits one layer down from both, beneath the control plane [4].

I do not know which of these wins, and I doubt anyone does. A permissively licensed control plane has a real shot at becoming shared infrastructure the way Linux and Kubernetes did, but how the project sustains itself over time is an open question of its own, and the vendors that sell models and cloud have reasons to keep the governance layer inside their own stacks. Red Hat is explicitly betting on the Linux path [3]. Runlayer is explicitly betting on the SaaS path. The launch landed the same day OpenAI announced Dots and ChatGPT Space at DevDay, which VentureBeat reads as the app and UX layer of the same emerging workforce: “Dots are workers; Space is where those workers collaborate with people; OCE is infrastructure for governing the broader agent fleet” [4]. The control plane is being positioned as the unglamorous middle of that stack.

The caveats

I want to be straight about what this is not. It is a pre-1.0 pilot, recommended for internal pilot workloads, with a 1.0 release planned “later this year” and a security reference architecture still to come [1][4]. Every substantive technical claim traces back to OpenClaw’s own announcement, Red Hat’s blog, or a quote from OpenAI’s OCE lead relayed through VentureBeat [1][3][4]. I found no independent third-party evaluation of OCE’s security or governance claims. The CyberScoop piece in my sources covers NVIDIA’s runtime, not OCE itself [5].

“Vendor-neutral” is also a claim, not a proven fact. The project originated inside OpenAI, its most visible backer is OpenAI, which is simultaneously shipping the adjacent Dots and Space products, and the OpenClaw Foundation is not a Linux Foundation-governed body the way NVIDIA’s Open Secure AI Alliance is [1][4]. Whether a neutral control plane stays neutral when a model vendor is both its steward and its customer is the open question, not the settled answer. And the “IT organizations are banning agents” motivation is asserted, not measured. Neither OpenClaw nor VentureBeat offers survey or usage data to quantify it [1][4]. The skepticism underneath it is documented, though. Gartner labeled OpenClaw a source of “unacceptable cybersecurity risk” for business users in February 2026, and China’s Computer Emergency Response Team warned in March that it shipped “extremely weak default security configurations.” The Register’s headline on the launch was “OpenClaw slips on a suit to evade widespread business bans” [6].

Bottom line

The stack now has three layers: harness, runtime, control plane. I covered the runtime when it shipped in The Secure Agent Runtime Arrives, and the control plane idea in The Rise of the Agent Control Plane. What changed this week is that the control plane is MIT-licensed, self-hostable, originated at OpenAI and developed in the open with contributions from Red Hat and NVIDIA, with OpenAI and Red Hat piloting it internally [1][3][4]. Whether the control plane ends up a product or a protocol is the question this launch does not settle. It is the question the next year of agent infrastructure is going to be argued over.

Sources

  1. OpenClaw Enterprise: The Open Agent Platform — OpenClaw
  2. openclaw/openclaw-enterprise — GitHub
  3. Why Red Hat is building an open foundation for enterprise agents with OpenClaw Enterprise — Red Hat
  4. OpenClaw launches free enterprise control plane for persistent AI agents, backed by OpenAI, Red Hat and Nvidia — VentureBeat
  5. As AI world debates security, NVIDIA releases open source tools for agents — CyberScoop
  6. OpenClaw slips on a suit to evade widespread business bans — The Register